Finding #059 - Pre-Payment Counterparty Screening Is a Live Market: the Sanctioned Address List Has 38 Entries, Not One, and the Money Is in Flows, Not Hits

Summary

The 2026-10-21 brief's only uncovered money-making item was the "wallet linked to Drift exploit sends $61M to Tornado Cash" headline (tagged risk, Stream 3/9) alongside the Qubic weak-seed hack (tagged risk, Stream 3/9). Every other brief item was already published: Coinbase's stablecoin report (article), Utah/Kalshi (#057), Injective/BDACS (#054), Project Eleven/Relm insurance (#055), CFTC Frontier Forum (#058), OpenAI/Orchestra Bio (a low-signal acquisition story with no reachable paid route). The backlog was closed - every open item is a revisit due 2026-10-27 or later - so this cycle also ran the mandatory revenue-route pass, and the risk headlines turned out to be the best available seed for it.

Why? Because a hack that ends with $61.5M of stolen funds going into an OFAC-sanctioned mixer is not a news event, it is a product requirement. It is the clearest possible statement of what an agent about to pay an address needs to know, and it names the buyer: the agent, the wallet, the compliance officer behind it. The Qubic incident says the same thing from the other side: a claim can be forged with a valid signature when the key material was weak, so proof of ownership cannot rest on a signature.

Three results came out. First, the on-chain facts, verified directly rather than read from a headline. Second, the market measurement, which is thin in dollars but sharp in shape and which contains a genuine negative result: not one route priced at $0.10 or above clears the five-distinct-buyer bar, even though that band holds $138.54 of the family's revenue - it is one-to-three buyers making 70-100 calls each, which is a contract business, not a route business. Third, a completeness defect that a naive implementation of our existing wallet-risk todo would have shipped: the sanctioned address list is 38 entries, and the one everybody quotes is empty.

Part 1 - The Primary Sources

1.1 The sanction itself (US Treasury, primary)

OFAC's "Cyber-related Designation", release date 08/08/2022 - "U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash" - added TORNADO CASH (a.k.a. TORNADO CASH CLASSIC; a.k.a. TORNADO CASH NOVA) to the SDN List with 38 digital currency addresses: 37 for ETH and the same set for USDC. The canonical contract 0x8589427373D6D84E98730D7795D8f6f8731FDA16 is listed for both ETH and USDC, so a USDC balance at that address is sanctioned too. No other designation, license or relief covers these addresses, and the list has not been amended since.

1.2 The flows (Ethereum mainnet, measured today)

We read the chain directly through a public RPC (https://ethereum-rpc.publicnode.com), by chunking the 38 OFAC addresses through eth_getLogs (the RPC caps a filter at 10 addresses) and then re-reading every touched block with full transactions.

1.3 The Qubic claim platform (primary, and a design lesson)

Qubic's own recovery site (https://weak-seed-reclaim.qubic.org/, linked from the project's statement and the fixed wallet release v4.26.4) documents the post-exploit payout process, and one sentence in it is worth more than the rest of the incident:

The rest of the process is a usable pattern: a claim window open to 2027-05-01; two lanes (fast for strongly evidenced uncontested claims, extended for contested ones); a 7-day public dispute window in which approved claims are published as address and amount only before payout; and two different payout sources with different speeds and different dependencies - funds still on the chain come from a recovery escrow, funds that reached an exchange come back only through the exchange and law enforcement. A transferable primitive for our own escrow and attestation work: a signed artefact proves the payload, never the ownership, and a claim needs out-of-band evidence plus a dispute window plus an adjudicator.

Part 2 - Demand Measurement (Our Own Pull, 2026-10-21T~03:40Z)

Registry: 28,001 listings, 2,681 hosts, 819,692 calls, $88,231.31 list-price revenue over 30 days (57 pages at limit=500, 94.5 MB). Sanity check against the previous cycle: finding #058 measured 27,983 listings and $87,929.05 for the same endpoint about an hour earlier - consistent, and the only difference is growth.

Classification is deliberately strict: a listing enters the screening family only if its own description names a screening subject (wallet / address / payee / counterparty / account / holder) and a screening context (sanctions / screen / block / taint / mixer / exploit / risk / trust). Keyword families were then split into SCREEN-SANCTION (899 listings, 15,801 calls, $319.93) and SCREEN-TAINT (48 listings, 186 calls, $3.97) - mixer, stolen-fund and exploit-provenance terms. Combined: 947 listings, 353 hosts, 15,987 calls, $323.90, which is 0.37% of measured registry revenue.

2.1 The hand audit (why the family numbers must be read carefully)

We fetched the live 402 challenge of every one of the 24 qualified routes and read the seller's own description. 13 are genuine counterparty or agent-risk screens; 11 are false positives that a keyword rule swept in: agent.pocket.network/v1/prompt-injection-detect (LLM text classification), /v1/taint-check (software supply-chain scanning - "taint" here means a malicious npm package, not tainted crypto), /v1/debarment-exclusion (SAM.gov exclusions), /v1/name-resolution (ENS), /v1/kava, /v1/pocket, /v1/juno (Cosmos chain RPC), api.oblique.markets/.../solana-priority-fee (network state), agdata.shveik.dev/x402/unblock (Cloudflare bypass), netintel.dev/email/verify (email validation), api.solenrich.com/.../stonk-screener (token screener). Two earlier passes produced the same class of error - a taint route that screens packages, a "commodity-price" route classified as counterparty provenance because its description contains the word "provenance". The numbers below use only audited routes.

2.2 The ten genuine routes, and what they earn per buyer

These ten are $5.40 of the $323.90 family (1.7%). The market is small. What it is not is shapeless: $3.85 of the $5.40 (71%) comes from one $0.05 route that is not a sanctions check at all - it is a flow watchlist that reports the wallets involved in large movements. The Drift story is precisely such a flow: 25,710 ETH moving out of an exploit-linked address into a mixer, in a two-hour window, in 100-ETH chunks. A buyer who wants to know "did sanctioned or stolen money just move near me" is buying the flow, not the hit.

Above $0.10 the family becomes a contract business, and the numbers say so clearly: api.losbeto.xyz/wallet-scan $0.10 (2 payers, 74 calls, $3.70 per buyer), api.losbeto.xyz/launch-risk $0.10 (3 payers, 75 calls, $2.50 per buyer), api.losbeto.xyz/job/wallet-audit $0.15 (1 payer, 71 calls, $10.65 per buyer), api.strale.io/x402/sanctions-check $0.216 (1 payer, 100 calls, $21.60 per buyer). One buyer, seventy to one hundred calls, no marketplace competition - that is a report or an alert feed, and it should be priced to the buyer, not to the cheapest competitor.

Part 3 - What the Market Publishes as the Product Spec

The live 402 bodies carry the output schema, and the schemas converge on one shape. This is sanctions.nsgoods.org/screen's own advertised output, verbatim from its discovery metadata:

Four elements of that shape are not optional, and each of them is a decision we would otherwise get wrong:

• coverage - the response declares what was actually checked (total_sdn_addresses: 960) and what was not (malicious_heuristic: "not_checked"). Verdix uses the same discipline from the other side: "Lite never answers safe. A clean result is no_known_risk". A screen that returns "safe" when a source was down is worse than useless, because the agent will trust it.
• sdn_snapshot_at - the list date, so a result can be aged and re-checked. OceanAlt goes further and offers a point-in-time re-screen: GET /api/risk?addr=0x...&on=YYYY-MM-DD - "was this address on our list that day? (compliance: 'we paid on Mar 5 - was it listed then?')". We have nothing like this.
• signed_by + signature - the verdict is signed. This is finding #055's "signed evidence" rule, already confirmed in the market, now visible in a *screening* response rather than an attestation one.
• Never charge for a failed check. Verdix: "caution means a check couldn't complete (a data source was down); those requests are never charged." ChainWard says the same on every route. This is the rule finding #041 wrote down as table stakes, and it is the reason an automated inspector can re-buy a screening route at all.

The verdict vocabulary is also converging, and it is worth copying because it is a gate and not a score: allow / review / decline (OceanAlt), BLOCK / REVIEW / ALLOW (cyberwarex), safe / caution / avoid (dyoeway, Verdix). And OceanAlt publishes the standard it claims (RAP - Responsible Agentic Payments) plus a free, offline-verifiable evidence bundle:

Therefore: a paid single-address hit/no-hit screen has no market. It is free at OceanAlt, free-to-compare at nsgoods and cyberwarex, and worth $0.001-$0.01 per call when paid at all. The paid product has to be what the free tier cannot do: settlement, bulk, tracing, and a signed artefact a third party can check.

One more primary source belongs here, because it prices the risk of getting this wrong. The USENIX Security '26 paper "When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Payments" (EPFL; 119 million Base and Solana transactions measured) documents Attack IV: an attacker who can shape catalogue metadata - Sybil listings, price and latency cues - can steer an agent toward a bad paid endpoint before the agent reasons about it at all. In this family that is a live hazard: a buyer asking "is this address safe?" is asking a paid, self-interested endpoint, and the answer may be a lie. A verdict a buyer can verify offline is not a nicety here; it is the defence.

Part 4 - Where We Stand, and the Defect in Our Own Code

Our shipped route /api/v1/query/wallet-risk is deriveWalletRisk in streams/stream-9-zerostorage/stateless-queries.js:106. It returns, per network, ETH and USDC balances and totals, plus two flags (empty_wallet, high_value). It contains no sanctions data, no labels, no taint, no age, no activity. It is priced like a screening route and shaped like a balance read - exactly what finding #041 wrote down, now with the market's response shape and price ladder measured.

Separately, a hard defect in our own measurement code: streams/shared/bazaar-demand-reader.js now fails against the live registry. The CDP endpoint at limit=1000 returns more than 1 MB, and requestJson caps responses at 1,048,576 bytes, so readDemand() throws HttpError: Response too large. Measured: 57 pages at limit=500, 94.5 MB in total, largest single page 3.34 MB. Every demand figure in this repository, and the route-liveness-004 monitor that is supposed to watch our own listings, are currently unreadable.

Recommendations

1. counterparty-screen-001 - build the pre-payment screen, and make the list complete. [HIGH] A new paid route (or the rebuilt /api/v1/query/wallet-risk) that answers "may my agent pay this address?" with the market's own shape: { verdict: allow|review|decline, sanctioned, matched_label, taint[], coverage: { sdn_addresses_checked, sdn_snapshot_at, sources, not_checked[] }, sources[], as_of }. The data source must be the complete OFAC address list - 38 entries for Tornado Cash alone, of which 10 hold funds today, worth 279,610 ETH - not the one contract everyone quotes, and it must record the forwarding relationship to the pool contracts so a "depositor" is not scored as "empty". Never answer "safe": answer clear or no_known_risk. Never charge for a failed check. Sign the response (Ed25519, JWKS, free verification endpoint - finding #055) and add the point-in-time re-screen (&on=YYYY-MM-DD). Price the single-address call at $0.005 (cyberwarex, nsgoods, x402-endpoints) - the tier where the buyer depth is.
2. counterparty-batch-001 - ship the batch, because that is where the paid money is. [MEDIUM] POST /api/v1/query/wallet-risk/batch for up to 25 addresses in one settlement at $0.10 (OceanAlt's measured batch price; finding #035's comparables were $0.08). Update s2-todo-012, which currently carries $0.05-$0.08.
3. screen-price-ladder-001 - price the decision tier by what one buyer is worth, not by the cheapest competitor. [HIGH] This inverts the rule finding #041 encoded into s2-todo-013 ("price ≤ the passing seller's price"). Measured in this family, revenue per distinct buyer rises monotonically with price: $0.008 at $0.001, $0.042 at $0.005, $0.108 at $0.01, $0.77 at $0.05, $3.70 at $0.10, $21.60 at $0.216. A single-address screen is a $0.005-$0.01 commodity; a flow alert or a wallet report is a $0.05-$0.30 product bought by one buyer who then calls it 70-100 times. Build the price map with three tiers - read $0.005, batch $0.10, report/alert $0.05-$0.30 - and sell the top tier as a report or an alert feed, not as a per-call marketplace route.
4. flow-alert-001 - the money in this family is a flow, not a hit. [MEDIUM] 71% of the audited screen revenue comes from one $0.05 route that reports large on-chain movements and the wallets involved, and the Drift story is exactly that shape: 25,710 ETH out of an exploit-linked address into a sanctioned address inside two hours, in 100-ETH chunks. A route that answers "which addresses received large flows from a sanctioned or exploit-linked address in the last N hours, and how much" is the product this incident creates demand for. We have the on-chain readers to build it and we have already written the list we would watch. Do not build it as a standalone taint graph (see the negative result below) - fold the trace into the batch product.
5. Do not build a standalone taint or mixer-exposure graph. [CLOSED on evidence] The explicit taint family - mixer, stolen-fund and exploit-provenance routes - is 48 listings, 186 calls, $3.97 and 2 routes over the bar across the whole registry, and the two qualified ones are the mix of package-supply-chain and compliance routes already counted. A taint-graph product has no measured buyers. Fold one hop of taint into the screen response and stop.
6. demand-reader-pagination-001 - fix our own broken reader. [HIGH] streams/shared/bazaar-demand-reader.js throws Response too large against the live registry because the limit=1000 page exceeds the 1 MB cap in streams/shared/http-client.js. Page at 500 (57 pages, 94.5 MB) or raise the cap for this endpoint. Until that is fixed, every demand number in this repository and the route-liveness-004 monitor are unreadable. Fold into price-normalizer-001, which is already the "fix the demand reader before measuring again" todo.
7. evidence-dispute-window-001 - a signed artefact proves the payload, never the ownership. [MEDIUM] Qubic's own recovery platform states it plainly: with weak seeds "the attacker can produce the same valid signature you can", so ownership is decided by evidence the attacker cannot have, reviewed by a human, with a 7-day public dispute window before payout and different payout speeds for different recovery sources. Our attestation/* and escrow routes should model the same separation - signed payload, out-of-band ownership evidence, dispute window, adjudicated release - or they will be sold a guarantee they cannot honour. Relevant to evidence-verifiable-001 (#055) and s9-todo-007.

Impact on Streams and Todos

• Stream 2 (A2A) - one new paid route family and a corrected price map. counterparty-screen-001 (new), counterparty-batch-001 (new), screen-price-ladder-001 (new), flow-alert-001 (new).
• Stream 2 evidence merge - s2-todo-011 (rebuild wallet-risk) is now fully specified: the response shape, the completeness requirement, the never-charge-on-failure rule, the "never say safe" rule and the $0.005 price are all measured. s2-todo-012 (batch) moves to $0.10. s2-todo-013 (price map) gains the three tiers and the reversed pricing rule.
• Stream 3 (risk/governance) and Stream 9 (zero-storage) - the sanctions list becomes a static, versioned, locally cached artefact (no new external dependency, no key, no per-call cost), and the signed-verdict shape reuses the Ed25519 + JWKS work already scoped in evidence-verifiable-001.
• Operational - demand-reader-pagination-001 (new, and a precondition for any further demand measurement) folds into price-normalizer-001.
• Not opened - no CFTC-style compliance product, no taint-graph product, no standalone single-address screen sold above $0.01, and no inference/compute route (closed in #053).

Method and Caveats

• Demand figures are from our own pull of the public CDP x402 discovery registry on 2026-10-21 (~03:40Z), 28,001 rows in 57 pages, priced with a decimals-aware normalizer: 96% of listings accept Base USDC (6 decimals) and the rest are priced from the per-asset decimal inferred from the amount distribution, with unknown assets marked unpriced rather than guessed.
• Family classification is keyword-based on the seller's own description, and a manual audit of all 24 qualified routes found 13 genuine and 11 false positives. The family total (947 listings / $323.90) is therefore an upper bound: it includes non-crypto screens. The audited figures (ten genuine routes, $5.40) are the conservative reading and are the ones the recommendations use.
• The on-chain figures were produced by reading Ethereum mainnet through a public RPC at block 26,238,329. Deposit-event topics did not match, so the flow measurement was taken from full-block transactions to the 38 addresses rather than from logs - a strictly more inclusive method. The 25,710 ETH figure is the total sent by one address, which may include more than the reported mixer deposit; the 31,074 ETH daily total is all senders.
• Settlement counters in the registry (payers, calls) are provider-reported. Verdix, OceanAlt and the nsgoods/rubric routes were verified by fetching their live 402 challenges and advertised schemas today; the others were verified by their registry descriptions, which are the indexer's copy of the seller's own metadata.
• Nothing here is a compliance opinion, and no source sanctions or endorses a product. The OFAC designation is quoted as a list of addresses, and the Qubic statement is quoted as a description of a recovery process.
• The family is thin: ten audited routes earn $5.40 in 30 days, and $3.85 of that is one route. The value of this finding is the shape, the completeness defect, the reversed pricing rule and the two negative results - not the revenue pool.

Sources

• OFAC Recent Actions - "Cyber-related Designation" (2022-08-08) - TORNADO CASH added to the SDN List with 38 digital currency addresses (37 ETH + USDC), including 0x8589427373D6D84E98730D7795D8f6f8731FDA16 for both ETH and USDC
• Qubic weak-seed reclaim platform - claim window to 2027-05-01, "a signature alone cannot prove the funds are yours", 7-day dispute window, two-lane process, two payout sources (read 2026-10-21)
• Qubic web wallet - seed-generation fix, release 4.26.4 (2026-10-19)
• Cointelegraph: "Drift Exploiter Sends $61M in Ether to Tornado Cash" (2026-10-20) - the brief headline; every number in it was re-derived on-chain here
• sanctions.nsgoods.org/screen - live 402, 5000 atomic (=$0.005), accepts Base USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and Solana USDC; advertised output carries coverage.total_sdn_addresses: 960, sdn_snapshot_at, signed_by, signature
• sanctions.cyberwarex.com/screen - live 402, 5000 atomic (=$0.005); "OFAC sanctioned crypto-address list and a curated taint set (mixer, hack, scam) ... a single BLOCK / REVIEW / ALLOW"
• api.aurelianflo.com/api/ofac-wallet-screen/:address - live 402, 10000 atomic (=$0.01); exact match against Treasury's SDN advanced XML
• api.losbeto.xyz/whale-alert - live 402, 50000 atomic (=$0.05); large on-chain USDC/SOL movement watchlist with the wallets involved; 5 payers / 77 calls
• Verdix pricing page - Lite $0.01 / Quick $0.02 / Standard $0.10 / Deep $0.50; "Lite never answers safe"; "those requests are never charged"; "Deep does not yet run any check Standard doesn't"
• oceanalt.com machine-readable manifest - free tier (/api/decide, /api/risk, /api/endpoint, /api/payment-request, /api/evidence/bundle, /api/risk/recent) and paid Base USDC endpoints (batch $0.10, trace $0.20, decision $0.30); RAP standard
• oceanalt.com free evidence bundle - signed bundle, offline verification key at /.well-known/oceanalt-keys.json
• x402check.xyz/v1/risk-check - $0.0035; "Check a counterparty before paying: OFAC SDN, phishing and drainer feeds ... returns a score and a signed verdict"
• agents.dyoeway.org/verify - live 402, 10000 atomic (=$0.01); verdict safe/caution/avoid, domain age, red flags
• rubric-protocol.com/v1/x402/attested-screening - $0.01; attested OFAC/UN/UK/EU/BIS screening, fuzzy matches as "candidates for human adjudication"
• api.relaystation.ai/v1/screening/match - $0.01; OFAC/EU/UK + PEP watchlists, one of 155 tools on one balance
• api.craigmbrown.com/v1/services/agent.trust-badge - $0.01; agent settlement-history trust badge, honest zero instead of a synthetic score
• intel.twzrd.xyz/v1/intel/quick - $0.001; seller wash risk, and the note "no signed receipt - use /v1/intel/trust for the portable proof"
• USENIX Security '26: "When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Payments" - EPFL; 119M Base/Solana transactions; Attack IV: discovery-layer steering of agents toward malicious paid endpoints
• CDP x402 discovery registry (own pull, 2026-10-21 ~03:40Z, 28,001 rows in 57 pages)
• /tmp/kilo/registry-raw.json (registry snapshot), /tmp/kilo/pull-registry.js, /tmp/kilo/strict-screen.js (strict family measurement), /tmp/kilo/verify-routes.js (live 402 audit of the 24 qualified routes), /tmp/kilo/taint-flow.js (on-chain flow measurement)
• streams/stream-9-zerostorage/stateless-queries.js:106 (deriveWalletRisk), streams/shared/bazaar-demand-reader.js (the 1 MB page failure), streams/shared/http-client.js:80 (the size cap)